A denied tool call does not reach the tool.

Below is a real run, recorded. Two calls went through a policy boundary to a server that counts what actually arrives. One was permitted and arrived; one was denied and never did. You don't have to take that on trust: the evidence is signed, it's on this page, and you can try to forge it.

1 · What happened

The agent

Two calls, one policy.

Tool	Decision

The witness (a separate process)

Calls that actually arrived.

–

#	Tool	Arrived

The witness holds no policy and shares no code with the thing making decisions. It also has no capabilities: every tool it exposes returns a stub, so nothing is destroyed even if the boundary fails. A demo of a safety control should be safe when the control is wrong. One honest caveat: the decisions in the bundle are signed; this arrival count is our own recording and is not. Nothing on this page proves the count to you; rung 2 is where you run the boundary yourself and generate your own.

2 · Check the evidence yourself

Both decisions are in one signed bundle: the permit and the refusal. Verification runs in your browser: nothing is sent anywhere, and you can read the code.

Read this before trusting the green. The key above came out of the bundle itself, because the proxy mints a new signing key every time it starts. Checking a bundle against its own key proves it is internally consistent and unaltered; it does not prove who issued it. Real provenance means pinning a key you obtained beforehand, and we do not yet publish a stable one. That gap is ours; it's rung 4 below.

3 · What this does and does not prove

This page A recorded run on our machine, signed with a key minted for that session. The receipts are real and the verification is real. It is a demonstration, not an audit, and it cannot show you the boundary refusing something live.
Run it yourself Install the published proxy from npm, point it at your own server, and drive it. Nothing here is a special build: it is @attested-intelligence/aga-mcp-server, unmodified.
Offline verification Take the bundle to a machine that has never touched ours and check it with the separately published verifier. Different package, no shared code with what signed it.
A published identity, and a third-party corpus A stable gateway key you can pin before you ever call us, so a receipt proves who signed it, plus a conformance corpus anyone can run against any implementation, ours included. Neither exists yet.

Known limit, stated plainly: this governs the agent's path to the tool; it is not a network firewall. If a tool is reachable by another route, that route is ungoverned, and the proxy says so itself at startup when you point it at a network upstream. In the recorded run the tool was a child process of the boundary with no network path at all.

4 · Do it without us

Download the bundle and verify it with the independently published verifier. The command below checks integrity only; pinning the bundle's own key would be circular (see section 2), so the key is shown separately.

This session's gateway key (rotates each restart):

Every receipt on this page was signed by the published @attested-intelligence/aga-mcp-server proxy, unmodified, during a real run.